-1

I try to get data from mysql table using php and alamofire in swift, but i can't, this is my code:

 guard
        let useremail = emailTextField.text,
        let password  = passWordTestField.text
    else { return }

    let parameters: Parameters = [
        "useremail": useremail,
        "password": password
    ]
    let api = URL(string: "anyurl/Authentication.php")
 
    AF.request(api!, method:.get, parameters: parameters).responseDecodable(of: SignIn.self) {  response in
        print(response.data as Any)
        if  let data = response.data {
           
            guard let dataDecoded = try? JSONDecoder().decode(Reponse.self, from: data) else {
                print("An error taked place")
                return
            }
            if dataDecoded.error == false {
                print("it is done")
            }else {
                print("it isn't done")
            }
        }
    }

SignIn:

struct SignIn: Codable {
    let useremail: String
    let password: String
}

Reponse:

struct Reponse: Codable {
let error: Bool
let message: String

}

PHP:

 <?php
include_once ('Connection.php');
 
$name = $_POST['username'];
$password = $_POST['password'];


$sql = "SELECT username, password from user where useremail = '$useremail' AND  password ='$password'";
$result = $conn->query($sql);

if ($result->num_rows > 0) {
    $response['error']=false;
    $response['message']="New record created successfully";
} else {
    $response['error']=true;
    $response['message']="Error: " . $sql . "<br>" .     mysqli_error($conn);
}
echo json_encode($response);
$conn->close();
?>

note, that i use the same code for INSERT and it is done successfully. in previous code, I always get (An error taked place)

  • 1
    Firstly, you are using `.get` for your Alamofire call but you are retrieving the parameters via `$_POST`. Secondly where does `$useremail` comes from? Shouldn't it be `$name` instead? – koropok May 09 '22 at 01:46
  • yes, you are right, i corrected this error, and it work now – monther shahowd May 09 '22 at 07:44
  • **Warning:** You are wide open to [SQL Injections](https://php.net/manual/en/security.database.sql-injection.php) and should use parameterized **prepared statements** instead of manually building your queries. They are provided by [PDO](https://php.net/manual/pdo.prepared-statements.php) or by [MySQLi](https://php.net/manual/mysqli.quickstart.prepared-statements.php). Never trust any kind of input! Even when your queries are executed only by trusted users, [you are still in risk of corrupting your data](http://bobby-tables.com/). [Escaping is not enough!](https://stackoverflow.com/q/32391315) – Dharman May 09 '22 at 09:56
  • **Never store passwords in clear text or using MD5/SHA1!** Only store password hashes created using PHP's [`password_hash()`](https://php.net/manual/en/function.password-hash.php), which you can then verify using [`password_verify()`](https://php.net/manual/en/function.password-verify.php). Take a look at this post: [How to use password_hash](https://stackoverflow.com/q/30279321/1839439) and learn more about [bcrypt & password hashing in PHP](https://stackoverflow.com/a/6337021/1839439) – Dharman May 09 '22 at 09:56
  • @Dharman yes, you are right, this was just example – monther shahowd May 28 '22 at 21:14
  • Can you provide a better example please? – Dharman May 28 '22 at 21:14

0 Answers0